Your AI Assistant Is a Data Export Channel. Govern It Like One.

Summary

An AI assistant connected to live data can turn every prompt into a cross-border transfer. For a Nigerian pharmaceutical or Cameroonian bank, that is a board liability. Contracts are promises. Controls are architecture: permission the assistant like a user, redact before egress, log everything, keep the model sovereign.

The problem

An AI assistant connected to live company data is the fastest-adopted export channel in your organisation. Most boards never approved it.
Nobody sets out to breach a regulation. Picture a quality manager at a pharmaceutical manufacturer in Lagos who pastes a batch deviation report into a chatbot to "tidy the wording". The report holds supplier prices, product formulas and an adverse-event note with patient details. Now picture a relationship manager at a bank in Douala who asks a connected assistant to "summarise this client's last year". The tool pulls the client's history and RIB account number and sends it to a model hosted in another country. Both people did their jobs faster. Both moved regulated data across a border.
This is a legal event, not an IT preference. Under Nigeria's Data Protection Act 2023, personal data may leave the country only if the recipient is adequately protected, an approved transfer instrument is in place, or a Section 43 exception applies. The basis must be recorded. Health data is sensitive personal data. In Cameroon, Law No. 2024/017 of 23 December 2024 makes transfers abroad subject to adequate protection and prior authorisation. Sending data abroad is not automatically a breach. Sending it abroad with no recorded basis is.
DeepSeek is the clearest example. The hosted DeepSeek service's own privacy policy says it collects, processes and stores personal data in the People's Republic of China, and that inputs may be used to train its models unless you opt out. Italy's data protection authority ordered the chatbot blocked in January 2025 after the company's answers failed to satisfy it. The model itself is not the problem: an open model run on your own hardware sends nothing to China. The route is the problem, and a regulator will draw exactly that line.
Three exposures a board should name:
The route. Where does the prompt go, and on what legal basis? A contract that lets a vendor keep inputs "for quality purposes" is a promise, not a control.
The identity. An assistant wired in through a service account answers a junior clerk with the finance director's access.
The record. If a regulator asks what the assistant did for a user last Tuesday, "we don't know" is the answer.
What it costs. For a controller of major importance, the NDPA allows penalties of up to ₦10 million or 2% of annual gross revenue, whichever is higher. The larger bill is usually the project itself: legal review stops the AI rollout, or the data has already left and cannot be recalled.

What was done

1. Put the assistant inside the permission model. Every action it can take is registered with a required grant, checked through the same cache as the rest of the system. A missing grant is refused and logged. A missing declaration is refused too. Fail closed.
2. Make isolation structural. Every read runs through the calling user's tenant-bound database connection, so one client's assistant cannot see another client's rows. The database enforces it. Nobody has to remember to check.
3. Filter before retrieval. Documents carry a confidentiality tag, and retrieval returns only what the calling user is cleared to see. A confidential HR memo never reaches the assistant's context, because the query never returns it.
4. Give the assistant tools, not a copy of your data. It has a catalogue of named actions, each with a permission requirement. It runs a scoped query as the calling user, returns the answer and forgets. There is no shadow copy of your books in someone else's cloud.
5. Redact before anything leaves. A pattern-based sanitizer strips IBANs, card numbers, OHADA-zone RIB accounts, tax IDs, phone numbers and emails from the message, the history, the retrieved knowledge and every tool result. It is a control for structured identifiers, not a miracle. That is why step 7 exists.
6. Log every prompt and every action. Outbound prompts, tool calls, denials and executions are recorded. When a regulator asks what the assistant did, there is an answer.
7. Make the model sovereign where the data cannot travel. For banks, health and government, the same architecture points at a model hosted on the client's own hardware, or on a Lagos or Douala sovereign-cloud GPU. The code does not change. Only the endpoint does.
8. Record the basis for any transfer that remains. Vendors that stay in the picture sit under no-training agreements, and the transfer basis the law requires is written down.

The result

The assistant works on live data without exposing it: every action is permissioned and logged, structured identifiers are redacted before anything leaves, and the model runs on sovereign infrastructure where the data cannot travel.